Ransomware Prevention and Remediation Consulting Pasadena

Ransomware : Your Worst Information Technology Nightmare
Ransomware has become a modern cyber pandemic that poses an enterprise-level threat for organizations unprepared for an attack. Different versions of ransomware like the CrySIS, CryptoWall, Bad Rabbit, NotPetya and MongoLock cryptoworms have been circulating for years and still inflict harm. Modern variants of crypto-ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch and Nephilim, as well as frequent unnamed malware, not only do encryption of on-line critical data but also infect most available system backups. Data synchronized to cloud environments can also be corrupted. In a poorly architected environment, this can make any restore operations useless and effectively knocks the datacenter back to zero.

Getting back services and data after a crypto-ransomware event becomes a sprint against the clock as the targeted business tries its best to contain the damage and remove the crypto-ransomware and to restore mission-critical operations. Due to the fact that crypto-ransomware needs time to replicate, attacks are frequently sprung during nights and weekends, when penetrations are likely to take more time to identify. This compounds the difficulty of rapidly assembling and organizing a capable response team.

Progent makes available a variety of help services for securing Pasadena enterprises from crypto-ransomware penetrations. These include team training to help recognize and not fall victim to phishing exploits, ProSight Active Security Monitoring (ASM) for endpoint detection and response using SentinelOne's AI-based cyberthreat defense to detect and disable day-zero malware assaults. Progent also can provide the services of experienced ransomware recovery engineers with the track record and perseverance to re-deploy a breached system as quickly as possible.

Progent's Ransomware Restoration Support Services
Soon after a crypto-ransomware event, sending the ransom in Bitcoin cryptocurrency does not guarantee that cyber hackers will return the needed codes to decrypt all your data. Kaspersky ascertained that seventeen percent of crypto-ransomware victims never recovered their information after having sent off the ransom, resulting in increased losses. The gamble is also costly. Ryuk ransoms commonly range from 15-40 BTC ($120,000 and $400,000). This is greatly above the usual ransomware demands, which ZDNET determined to be around $13,000 for smaller organizations. The other path is to re-install the vital elements of your Information Technology environment. Without access to full information backups, this calls for a wide range of skill sets, top notch project management, and the capability to work non-stop until the task is completed.

For twenty years, Progent has offered expert IT services for businesses across the US and has achieved Microsoft's Gold Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes professionals who have earned top certifications in important technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity experts have earned internationally-renowned certifications including CISM, CISSP, CRISC, and GIAC. (Refer to Progent's certifications). Progent in addition has experience in financial systems and ERP application software. This breadth of experience affords Progent the skills to knowledgably determine important systems and consolidate the remaining components of your network environment following a crypto-ransomware event and assemble them into a functioning system.

Progent's security team of experts utilizes state-of-the-art project management tools to orchestrate the complex restoration process. Progent knows the importance of working quickly and together with a customer's management and IT resources to prioritize tasks and to get critical systems back on-line as soon as humanly possible.

Client Story: A Successful Crypto-Ransomware Attack Recovery
A customer engaged Progent after their organization was brought down by the Ryuk crypto-ransomware. Ryuk is believed to have been created by Northern Korean state sponsored criminal gangs, suspected of using approaches exposed from the United States National Security Agency. Ryuk seeks specific companies with limited tolerance for disruption and is among the most lucrative iterations of crypto-ransomware. Headline victims include Data Resolution, a California-based info warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a regional manufacturing business located in Chicago and has about 500 employees. The Ryuk event had frozen all essential operations and manufacturing capabilities. The majority of the client's data protection had been directly accessible at the beginning of the intrusion and were destroyed. The client considered paying the ransom (more than $200,000) and praying for good luck, but in the end brought in Progent.

Progent worked hand in hand the client to rapidly understand and assign priority to the mission critical elements that needed to be recovered in order to continue departmental functions:

• Active Directory (AD)
• Microsoft Exchange Email
• Accounting/MRP

Within 2 days, Progent was able to re-build Active Directory services to its pre-penetration state. Progent then charged ahead with reinstallations and hard drive recovery on essential servers. All Exchange data and attributes were usable, which accelerated the rebuild of Exchange. Progent was able to assemble non-encrypted OST files (Microsoft Outlook Off-Line Data Files) on various workstations to recover mail information. A not too old offline backup of the businesses accounting/MRP systems made it possible to recover these required programs back available to users. Although significant work needed to be completed to recover fully from the Ryuk event, core services were returned to operations rapidly:

Over the following few weeks important milestones in the recovery process were achieved in tight cooperation between Progent team members and the customer:

• Internal web applications were returned to operation without losing any data.
• The MailStore Exchange Server exceeding four million historical messages was restored to operations and accessible to users.
• CRM/Customer Orders/Invoicing/Accounts Payable/AR/Inventory Control functions were fully operational.
• A new Palo Alto 850 firewall was brought online.
• Most of the user desktops were fully operational.

Conclusion
A potential business extinction catastrophe was avoided through the efforts of top-tier experts, a broad array of subject matter expertise, and tight teamwork. Although upon completion of forensics the ransomware virus incident detailed here would have been identified and stopped with up-to-date security systems and best practices, user and IT administrator training, and properly executed incident response procedures for information backup and proper patching controls, the reality is that government-sponsored cybercriminals from Russia, North Korea and elsewhere are relentless and will continue. If you do get hit by a crypto-ransomware attack, feel confident that Progent's roster of professionals has substantial experience in crypto-ransomware virus blocking, mitigation, and information systems disaster recovery.

Download the Crypto-Ransomware Recovery Case Study Datasheet
To review or download a PDF version of this case study, click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Consulting Services in Pasadena
For ransomware cleanup consulting services in the Pasadena metro area, call Progent at 800-462-8800 or go to Contact Progent.